Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Cisco ASA that authenticates off of RADIUS / AD. I need to give a user VPN access but I want to limit their access to only one host. What is the best way to do this?

share|improve this question
    
Which version of the ASA software are you using? ASA 8.4 includes user based access-control which might work for you. –  dunxd Nov 17 '11 at 14:46
    
8.2 and I want to upgrade but wont be able to just for this. –  evolvd Nov 17 '11 at 15:37
add comment

1 Answer

up vote 1 down vote accepted

Here is what I ended up doing:

Create a new group-policy that has the split-tunnel with only the host/network I want the VPN user to access. Then create a ACL to only allow network access to what you want. Apply this ACL to the GP with the following command: vpn-filter value (you have to apply this when you are in the GP attributes). Then make a new group-tunnel and tie it back to the new GP. Now you can give this user the new PCF and the user will be locked down to the host / network you specified.

I was hoping to find a solution where I wouldn't have had to make a new GP, TP, and local ASA user but this works I guess.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.